Categories: Malware

Win32/Kryptik.AXWR removal tips

The Win32/Kryptik.AXWR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.AXWR virus can do?

Behavioural detection: Executable code extraction – unpacking
SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Unconventionial binary language: Russian
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Steals private information from local Internet browsers
Exhibits behavior characteristic of Pony malware
Collects information about installed applications
Harvests cookies for information gathering
Harvests credentials from local FTP client softwares
Harvests information related to installed mail clients

How to determine Win32/Kryptik.AXWR?


File Info:
name: E1BE93C78848F2F7188D.mlwpath: /opt/CAPEv2/storage/binaries/5fdf3a04b81b2de5b95108780bc898ece3189b67f238a5b217fc436159351150crc32: A69E08E0md5: e1be93c78848f2f7188da32b5f1689b0sha1: 6328fd3d8f6b683f8dd1b61e32ed6d25b198fcfcsha256: 5fdf3a04b81b2de5b95108780bc898ece3189b67f238a5b217fc436159351150sha512: 9951cbdf97bc44a8e3e22f0931bfcfd870b36eee67201dfc2dc95c39936a5a3cd4c9174f6fae856fc3e309643f10819b839d78409a55c8d2694cac6f7e53a49fssdeep: 3072:4PAAwpl6vFfKQYiYOaRSRBMENXPQO08OlztCFs4nhiFkRcOYnlZi:4PAAelEFfRJGm14O08Mws4type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T100D3D055327008E3FD6662F9CA9BDE4623C42B594705D65F31DAEF0B9EA21F0EB22407sha3_384: b63661477df94cbf38ad6d75a7dcaf63347890292fb068838a823284517ab71fcb6a74b7953a26acf5f36b05ae413a25ep_bytes: 558bec5568df19400068a0124000c35dtimestamp: 2013-04-03 11:31:02
Version Info:
CompanyName: Корпорация МайкрософтFileDescription: Напоминания Windows OOBEFileVersion: 5.1.2600.5512 (xpsp.080413-2111)InternalName: OOBEBALN.EXETranslation: 0x0419 0x04b0

Win32/Kryptik.AXWR also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Generic.lWBM
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.1932
MicroWorld-eScan	Gen:Variant.Razy.790951
FireEye	Generic.mg.e1be93c78848f2f7
CAT-QuickHeal	TrojanPWS.Zbot.Gen
ALYac	Gen:Variant.Razy.790951
Cylance	Unsafe
VIPRE	Trojan.Win32.Zbot.m (v)
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0040f0ce1 )
Alibaba	Trojan:Win32/Bulta.85192725
K7GW	Trojan-Downloader ( 0040f0ce1 )
CrowdStrike	win/malicious_confidence_90% (W)
BitDefenderTheta	Gen:NN.ZexaF.34212.iq0@ammPgWwc
VirIT	Trojan.Win32.Agent.BWB
Symantec	Backdoor.Trojan
ESET-NOD32	a variant of Win32/Kryptik.AXWR
TrendMicro-HouseCall	TROJ_RANSOM.SM0E
Paloalto	generic.ml
ClamAV	Win.Packed.Zbot-7671065-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Razy.790951
NANO-Antivirus	Trojan.Win32.Stealer.cqpjaf
SUPERAntiSpyware	Trojan.Agent/Gen-Fareit
Avast	Win32:LockScreen-AAV [Trj]
Tencent	Malware.Win32.Gencirc.114d4a01
Ad-Aware	Gen:Variant.Razy.790951
Emsisoft	Gen:Variant.Razy.790951 (B)
Comodo	Application.Win32.LoadMoney.ZED@6e0wcr
Zillya	Trojan.ZBotGen.Win32.1
TrendMicro	TROJ_RANSOM.SM0E
McAfee-GW-Edition	BehavesLike.Win32.Dropper.ch
Sophos	Mal/Generic-R + Mal/ZAccess-CG
Ikarus	Trojan-PWS.Win32.Fareit
GData	Gen:Variant.Razy.790951
Jiangmin	Trojan/Generic.bgfnc
Webroot	W32.Malware.Gen
Avira	TR/Crypt.ZPACK.Gen
MAX	malware (ai score=100)
Antiy-AVL	Trojan[PSW]/Win32.Tepfer
Kingsoft	Win32.HeurC.KVM007.a.(kcloud)
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	PWS:Win32/Fareit
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Zbot.R59686
Acronis	suspicious
McAfee	PWS-Zbot-FATG!E1BE93C78848
TACHYON	Trojan/W32.Agent.136704.XB
VBA32	BScope.Malware-Cryptor.SB.01798
Malwarebytes	Malware.AI.693616844
APEX	Malicious
Rising	Stealer.Pony!8.10FE4 (CLOUD)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.7164915.susgen
Fortinet	W32/Zbot.APRF!tr
AVG	Win32:LockScreen-AAV [Trj]
Cybereason	malicious.78848f
Panda	Trj/Hexas.HEU